MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6
SHA3-384 hash: c66b266ef4045361e295fd47b853e21042d338ca6bb0ad3779fdb2e366862f8427db85d2d5dbac1559a3e3cea2bbaf12
SHA1 hash: dd0870faa812e2f7ddecb1db006382342000521d
MD5 hash: 44f086aaddaa9e5e69ed61344c789ffc
humanhash: speaker-july-music-coffee
File name:NEW SIEMENS SIMATIC S7300 CPU 6ES7315 -2EH14 -0AB0.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:565'248 bytes
First seen:2021-11-11 16:29:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:m5pNOhmqJFTPakX9jgkZR5cDRVqW60iS:m7tq+kXqk1qG2
Threatray 1'622 similar samples on MalwareBazaar
TLSH T1C2C49D331241E8D5D53E5F76284220580FF13CA7DB29C219FEA6B58A1EF25D08D6E6A3
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205036/
Detection(s):
SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.5271.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/618d4513a00afa9663a427fa/reports/c16874ff-e472-4cd5-9ae1-91f0131b97ef/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7ac670ed-94ac-4d85-9e1d-b72ceaf0cecc
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/887701
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-11 16:30:12 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxjgttyrpi35jr76anug6754sno6hp74ymll2a2s72sichtkns3a._file
Verdict:
malicious
Similar samples:
0a80c9ca740f88fbdc0548e6cbf120dc03ee2ff243f610a1f7cc84de494f20bd
SnakeKeylogger
11f9fb92c34ae4431fd9715fc67b82ea29489135316105606cffe05944f3c476
SnakeKeylogger
12abc910bd5a6a05cdc8f1c94cc6a1968581850612c404267d63e77852cb4a90
SnakeKeylogger
222543cf9b75b95cc7c6e6f8252d2c205da8c9ec8d9c9587c19f1350b79f9dd3
SnakeKeylogger
2dae35b2c81440f320d907e58c7f331b08eff44f9803c796ea7deb1c53b5e145
SnakeKeylogger
3582856a25a8c10ed96e2ba53528ce32672f94e16cb93fb8160cc91be519e9d5
SnakeKeylogger
39a4ef63eed3420e394a7b9c0afd387ec27c4f70e1d293d2fe596ff3bf5ccd53
SnakeKeylogger
8e2a4b1e4cbecbe4f157cc6edda64c32b856fb53cb3c265c4d49175d597b7541
SnakeKeylogger
a82999d77adbff10ef701a595d165547fb73bf055dcae9b65d261e4d09c47654
SnakeKeylogger
b182edb787d497eeed41880c81331d9dee8ddfa00813672bc77f7b09a2528981
SnakeKeylogger
+ 1'612 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/211111-tztvrsggar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Contains code to disable Windows Defender
Snake Keylogger
Unpacked files
SH256 hash:
040c6cf46560c8c458bf125bffb0fa8ae0f479c260530155f82a7f23eb958b23
MD5 hash:
6072187dc252f3a165270ccc40299c26
SHA1 hash:
c68c1ae9e69429651938b2e1f6196c2cf64a245e
Link:
https://www.unpac.me/results/a2cf85e0-0554-464f-8bc4-63324a29b385/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/a2cf85e0-0554-464f-8bc4-63324a29b385/
SH256 hash:
f9cdc94440766f0afca53d08732725e5eb5be0414337f930abba67ac0a2fd207
MD5 hash:
68274d19e239b6a653c4fb43b0ef7887
SHA1 hash:
00684f7690b39c87792ec0ecc0230351e74e59ec
Link:
https://www.unpac.me/results/a2cf85e0-0554-464f-8bc4-63324a29b385/
SH256 hash:
2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6
MD5 hash:
44f086aaddaa9e5e69ed61344c789ffc
SHA1 hash:
dd0870faa812e2f7ddecb1db006382342000521d
Link:
https://www.unpac.me/results/a2cf85e0-0554-464f-8bc4-63324a29b385/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2dd269cf117a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/2dd269cf117a37d4c7fe03686f7fbc935de3bffcc316bd0352fea4811e6a6cb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205036/

Comments